This vulnerability is a Path Traversal flaw that can be leveraged to read arbitrary files from the server. By supplying a specially crafted path containing traversal sequences, an attacker may read sensitive data and potentially enable further compromise such as remote code execution if executable files are accessed. The weakness is classified as CWE-35.

The affected software is the WordPress WizShop plugin from hashshop, impacting all installations using versions up through 3.0.2.

With a CVSS score of 8.1, this represents a high severity issue, and the low EPSS score (< 1%) indicates that exploitation is considered unlikely to be frequent, though still possible. The vulnerability is not listed in the CISA KEV catalog. An attacker can likely trigger it by manipulating HTTP requests directed at the plugin, feeding a traversal pattern such as "../" to reach arbitrary files. No exploit code is publicly available, but the path traversal vector can be active through standard web requests.